Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 06 May 2014 14:39:38 -0600
From: "Vincent Danen" <>
To: "OSS Security List" <>
Subject: Postfix bounces arbitrary content

I noticed this bug in the Debian BTS and didn't see it mentioned anywhere:

I'm going to copy-n-paste a bit of the bug below for context:

An unmodified Postfix install can be made to bounce arbitrary
content from an arbitrary internal address to an arbitrary external
address, by an external sender who has no affiliation with the
organization that's running Postfix.

The possibilities for offensive use of this exploit are interesting.
Suppose I want to prevent from receiving an important
message that I think may be about to send to her.  I can
take 5,000 randomly selected articles from my local news spool, and
cause to bounce all of them from to
This will likely cause to block incoming mail from,
or from all of thus blocking Bob's message to Alice.

The reporter also references an almost-10-year-old email message to the postfix-user mailing list (to which there were no replies):

I don't believe this was reported to upstream at all, but I can't be 100% sure of that.

I'm not so much looking for a CVE assignment (unless one is warranted) as much as some determination as to whether or not this is a flaw because the way I see it, it's no different the spoofing the origin of an email (someone else's email address) to cause bounces to go to that address and with the same end result (from what it sounds to me).  It's quite possible that I'm missing something, but given there was no response to a similar message from 10 years ago, I'm not sure if it got missed or no one cares (or think it security-relevant or otherwise exciting).

Anyways, I see this bug in the Debian BTS and I see no response from Debian maintainers or any indication it was reported upstream, so I was curious what others might think or if I'm missing something (because I don't see anything too terribly exciting here).


Vincent Danen / Red Hat Security Response Team

Download attachment "signature.asc" of type "application/pgp-signature" (711 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.